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Set Items Description 

51 62210 NEWTON OR HANDHELD OR HAND () HELD .OR NOTEBOOK? OR LAPTOP? OR 

NODEOPCU OR .PALrtPILOT OR PALM ( ) (PILOT? OR TOP OR TOPS) OR 0- 
RGANIZER? OR INFORMATION ( ) TERMINAL? OR POCKET () PC 

52 ' 408466 MOBILE ( ) (TELECOMMUNICATION? OR DEVICE? OR COMPUTER?) OR CE- 

LLPHONE? OR CELLO PHONE? OR WIRELESS OR WIRE () LESS OR RADIO? - 
OR CELLULAR? OR (CALL OR PHONE) () DEVICE? 

53 1056681 MONITOR? OR TRACK? OR IDENTIF? OR TRACK OR WATCH? OR RECOG- 

NIZE? 

54 201794 CALLS OR REQUEST? OR ASK OR ASKS OR ASKING OR QUERY OR QUE- 

RIES 

55 3042137 PERFORM? OR FUNCTION? OR INSTRUCT? OR COMMAND? OR EXECUT? 

56 342546 CODE OR CODES OR CODING 

57 1528 61 TEMPORAR? OR INTERIM OR SHORT () TERM 

58 4108100 PREVENT? OR AVERT? OR FORESTALL? OR STOP???? PROHIBIT? OR - 

(STAVE OR WARD) ( ) OFF OR INHIBIT? OR IMPED? OR SUPPRESS? OR RE- 
FUS? OR REJECT? OR BLOCK? 

59 687956 ACTIVITY OR ACTION? 

510 27780 (MALICIOUS OR SUSPICIOUS) () (CODE OR ENTRY) OR VIRUS PREVEN- 

TION OR WORM OR TRO JAN () HORSE 

511 461734 SI OR S2 

512 245 Sll AND S10 1 

513 6 S12 AND S3 AND'- S4 

514 2056 S3 AND S4 AND S5 AND S6 

515 1588 S7 AND S8 AND S9 

516 343 Sll AND S14 

517 0 S16 AND S15 

518 1 S14 AND S15 

519 2 S14 AND S10 

520 2 S15 AND S10 

521 0 S16 AND S10 

522 11 S13 OR S18 OR S19 OR S20 

523 0 S12 AND S15 

524 76 Sll AND S15 

525 0 . S12 AND S7 AND S8 

526 63 S12 AND S8 

527 0 S24 AND S26 

528 146 S22 OR S24 OR S26 

529 13 S28 AND IC=(G06F? OR H04L?) 
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Remote subscriber information accessing system for telecommuting and 
mobile computing, has application gateway server to verify subscriber 
credentials before passing subscriber information to navigation module 

Patent Assignee: WIRELESS KNOWLEDGE (WIRE-N) 

Inventor: HERBINAUX L; INNESS-BROWN L; LINDSEY T D; MARTYN J; SALO R; 
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Number of Countries: 095 Number of Patents: 002 
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Abstract (Basic) : WO 200176190 A2 

NOVELTY - An application gateway server (19) has a navigation 
module to access device specific information on reception of URL format 
data, a session module to 'maintain temporary data associated with 
subscriber, a rendering module to obtain the requisite browser data 
based on desired action and current state, a data source module to 
pass subscriber information to navigation module, after verifying 
subscriber credentials by authentication module. 

DETAILED DESCRIPTION - INDEPENDENT CLAIMS are also included for the 
following : 

(a) Subscriber information accessing method; 

(b) Application gateway server 

USE - For allowing remote end users to rapidly and securely access 
information from variety of subscriber devices in wireless 
communication, telecommuting and mobile computing. 

ADVANTAGE - Enables more efficient communication when communicating 
over a slow network such as the internet. 

DESCRIPTION OF DRAWING ( S ) - The figure shows the block diagram of 
the remote subscriber information accessing system. 

Application gateway server (19) 

pp; 38 DwgNo 1/10 

Title Terms: REMOTE; SUBSCRIBER; INFORMATION; ACCESS; SYSTEM; MOBILE; 

COMPUTATION; APPLY; GATEWAY; SERVE; VERIFICATION; SUBSCRIBER; PASS; 

SUBSCRIBER; INFORMATION; NAVIGATION; MODULE 
Derwent Class: W01 y r -t 

International Patent Class- (Main) : H04L-029/06 
File Segment: EPI 



29/5/10 (Item 10 from file: 350) 

DIALOG (R) File 350: Derwent WPIX 

(c) 2004 Thomson Derwent. All rts. reserv. 

014373793 **Image available** 
WPI Acc No: 2002-194496/200225 
XRPX Acc No: N02-147672 



?attery capacity dispd^^ method for notebook computeJ^PLnvolves using 
existing light emitting diodes for disk drives during switch over from 
power management function to battery capacity display function 
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Abstract (Basic) : US 6275162 Bl 

NOVELTY - A lid switch (90) switches over the power management 
function to battery capacity display function, when battery capacity 
message is transmitted to keyboard controller unit (10) . A logic unit 
(40) temporarily stops the action signals of HDD (70) and FDD (80) . 
The different battery capacities are' displayed in different ways using 
LED module (30) for HDD and FDD. 

DETAILED DESCRIPTION - An INDEPENDENT CLAIM is also included for 
device of displaying the battery capacity using LEDs . 

USE - For displaying battery capacity using light emitting diodes 
of notebook computer. 

ADVANTAGE - Since the existing LEDs for disk drives are used for 
displaying the battery capacity, the additional LEDs and lid switch are 
eliminated and the user is.'let to know the battery capacity without 
taking battery outside., during off state or suspension state of 
computer. Hence the additional cost and operator work are reduced. 

DESCRIPTION OF DRAWING (S) - The figure shows the block diagram of 
circuit of battery capacity display method. 

Keyboard controller unit (10) 

LED module (30) 

Logic unit (40) 

HDD (70) 

FDD (80) 

Lid switch (90) 
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Modular motorized docking-undocking module assembly in docking station 
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Abstract (Basic) : US 5933321 A 

NOVELTY - A docking control system energizes the motor (78) mounted 
on a module (62), rotates cammed worm gear (72) which is operatively 
linked to latching and ejection unit (68,70). The latching unit 
connects computer to docking station by mating the connectors and when 
computer is to be unlocked, signal is transmitted to control system 
requesting the release -cif latching unit. 

USE - In docking station apparatus for docking portable computer 
such as notebook computer to peripheral devices such as keyboard, 
monitor , printer, mouse. 

ADVANTAGE - Use of optical switches for docking purpose is 
eliminated. Mismatch between docking of connector-to-connector is 
eliminated. 

DESCRIPTION OF DRAWING (S) - The figure shows an exploded view of 
motorized modular docking-undocking structure. 
Module (62) 

Ejection unit of module (68,70) 

Cammed worm gear (72) 

Motor (78) 
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Electronic asset system used in on-line banking system 
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Abstract (Basic) : US 5878138 A 

NOVELTY - Non-transf errable, tamper-resistant electronic assets are 
stored in electronic wallets. When the electronic assets are used, they 
are marked as exhausted sheets. A probabilistic fraud detection unit 
(42) samples subset of less than exhausted assets to detect bad assets 
used in fraudulent manner and identifies the electronic wallets that 
used bad assets. 

DETAILED DESCRIPTION - The electronic wallets are the smart cards 
PC card or other IC card which are programmed to store electronic 
assets. The fraud detection unit (42) compiles list of identified 



• x electronic wallets i^r distributes this list to warn^PJe identified 
electronic wallets that have been used in fraudulent manner. The 
electronic wallets are associated with particular users and are 
traceable to users. The electronic wallets are issued with temporary 
certificates that expire on the expiration date. 

The electronic assets are used to represent cash, coins, tokens, 
entertainment tickets, government entitlement provisions. The 
electronic asset system is' connected over private banking network* 
connection such as over a private banking network connection or public 
network e.g. internet, telephone, cable TV or wireless network such 
as cellular phone, paging network, satellite. 

INDEPENDENT CLAIMS are described for the following: 

(a) a computer-implemented method for detecting fraudulent 
transactions ; 

(b) a computer readable memory 

USE - For use in on-line banking system. Also for use in off-line 
devices such as beverage^vending machine, toll booths. 

ADVANTAGE - Is implemented both as anonymous and non- anonymous 
system. The non-trans ferrable assets are digitally signed by issuer and 
is dedicated to particular user thereby prevents malfunctioning. 
Facilitates carrying of electronic wallet. Facilitates derivation and 
storage of short hot lists on individual wallets. Uses fast and 
efficient fraud detection unit which requires less band width and has 
less sensitivity to delays, thereby prevents malfunctioning at early 
stage. Reduces connectivity and on-line requirements as well as 
transaction costs typically associated with full on-line verification 
system. The electronic wallet verifies certificate received from bank 
and authenticates signature on bank certificate to ensure that 
certificate is received from bank. Uses fraud detection system that 
sniffs out fraudulent activity with high probability and thus 
eliminates storage of exhausted coins and reduces processing cost. The 
electronic wallet is implemented as portable device with its display 
and keyboard as handheld computer, personal digital assistant or 
laptop computer. 

DESCRIPTION OF DRAWING (S) - The figure depicts general diagrammatic 
representation of electronic asset system. 

Fraud detection unit- ^(42) 
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Set Items Descriptl 

51 62210 NEWTON OR HANDHELD OR HAND () HELD OR NOTEBOOK? OR LAPTOP? OR 

NODE()PCU OR PALM PI LOT OR PALM ( ) (PILOT? OR TOP OR TOPS) OR 0- 
RGANIZER? OR INFORMATION () TERMINAL? OR POCKET () PC 

52 4 084 66 MOBILE () (TELECOMMUNICATION? OR DEVICE? OR COMPUTER?) OR CE- 

LLPHONE? OR CELL (} PHONE? OR WIRELESS OR WIRE () LESS OR RADIO? - 
OR CELLULAR? OR" ' (CALL OR PHONE) () DEVICE? 

53 1056681 MONITOR? OR TRACK? OR IDENTIF? OR TRACK OR WATCH? OR RECOG- 

NIZE? 

54 201794 CALLS OR REQUEST? OR ASK OR ASKS OR ASKING OR QUERY OR QUE- 

RIES 

55 3042137 PERFORM? OR FUNCTION? OR INSTRUCT? OR COMMAND? OR EXECUT? 

56 342546 CODE OR CODES OR CODING 

57 152861 TEMPORAR? OR INTERIM OR SHORT () TERM 

58 4108100 PREVENT? OR AVERT? OR FORESTALL? OR STOP???? PROHIBIT? OR - 

(STAVE OR WARD) ( ) OFF OR INHIBIT? OR IMPED? OR SUPPRESS? OR RE- 
FUS? OR REJECT? OR BLOCK? 

59 687956 ACTIVITY OR ACTION?' 

510 27780 (MALICIOUS OR SUSPICIOUS) () (CODE OR ENTRY) OR VIRUS PREVEN- 

TION OR WORM OR TROJAN () HORSE 

511 461734 SI OR S2 

512 245 Sll AND S10 

513 6 S12 AND S3 AND S4 

514 2056 S3 AND S4 AND S5 AND S6 

515 1588 S7 AND S8 AND , S9 

516 343 Sll AND S14 \ .? 

517 0 S16 AND SIS - J " 

518 1 S14 AND S15 

519 2 S14 AND S10 

520 2 S15 AND S10 
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522 11 S13 OR S18 OR S19 OR S20 

523 0 S12 AND S15 
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with a dynamic display for showing inquiries originating externally from 
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Abstract (Basic) : WO 200169884 A2 

NOVELTY - A mobile device (1) includes a microprocessor control 
unit (2) that is accessed via a user interface (3), while a display (5) 
communicates information from the control unit to the user using the 
requested software and firmware to execute functions on the 
microprocessor. The display is divided into static and dynamic display 
zones (7,6) and inquiries originating externally from the device are 
identified and routed to the dynamic display, while internally 
generated inquiries are shown on the static display. 

DETAILED DESCRIPTION - AN INDEPENDENT CLAIM is included for a 
system for indicating authenticity of inquiries for confidential 
identification codes . 

USE - Indicating authenticity of inquiries for confidential 
identification codes - 

ADVANTAGE - Detecting inquiries which may precipitate a security 
breach . 

DESCRIPTION OF DRAWING (S) - The drawing is a block diagram of the 
communication system 

Mobile device (1) 
Control unit (2) 
User interface (3) 



Display (5) _ 

Static and dynamic display zones (7,6) 
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RIES 

55 5696112 PERFORM? OR FUNCTION? OR INSTRUCT? OR COMMAND? OR EXECUT? 
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01024322 CMP ACCESSION NUMBER: WIN19940101S4092 

Mass Appeal - Here 1 s the lowdofcn on the latest storage options and some 
pointers on matching the mecfcv^ to your requirements. 

Noa Schoenfeld \ 
WINDOWS MAGAZINE, 1994, n 501 , 19\ 

PUBLICATION DATE: 940101 \ /~ 

JOURNAL CODE: WIN LANGUAGE: EnglVsh / 

RECORD TYPE: Fulltext \ / 

SECTION HEADING: Features \ / 

TEXT: \ / 

. . . home computers, such as the Commodore VICV20, actually used audio 

cassettes.) Optical storage devices, sucin as WORM (write-once, 
read-many) and CD-ROM drives, use a laseAto reara and/or write on... 

...head is magnetic as well. Solid -state \ etymologies , such as PCMCIA 
memory cards, are emerging, mainly for notebook , palmtop and pen units. 
PCMCIA memory cards tend to support eitherAstatic RAM or flash memory 
technology ... to change its magnetic value/ Vendors of magneto-optical 
disks include Pinnacle Micro, Relax TechmolcVy and Sony. WORM drives use 
a high-powered laser to melt holes in /he optically reflective coating on 
the disk. . . / \ 

...power laser can then read the dis/K by noting Ndifferences in the 
intensity of the reflected light. JwOB&L technology is expensive, but with 
a shelf life estimated at better frnan 20 years, it's designed for serious 
archival use. Phillips Consumer Electronics, Sony ,\ Panasonic 
Communications and JVC Information Products offer \wORM drives. CD-ROM 
has already become popular not/for its storage capabilities , but for its 
easy transportability. / \ 

...True to its name, the jukebox spins discs toward \ and away from the head 
as they are requested . JuKebox access is somewhat\slower than 
single-disc access, since the disc mechanism must swep the discs... 

...of PCMCIA cards is that they offer hot-swappable storage on machines 
with limited resources, such as notebooks . These featherweight cards 
have storage capacities of up to 40MB and are rugged enough for on-the... 
is only as effective as the entity administering it. Automating such tasks 
as tape or disk swapping, tracking of active and dormant files, and data 
backup will eliminate the substantial risk of human error. For... 
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Gilat Two-way Satellite Beta Test. (Everything you need to know about 
getting and using broadband Internet access.) (Product Announcement) 

Finnie, Scot 
WinMag.com, NA 
August 23, 2000 

DOCUMENT TYPE: Product Announcement LANGUAGE: English 

RECORD TYPE: Fulltext 

WORD COUNT: 3473 LINE COUNT: 00271 
TEXT: 

... connections . Toward the end of last week I got an e-mail message 
from Gilat-To-Home asking whether I wanted to take part in beta testing 
for the company's two-way satellite Internet... 

...Home (G2H) is an Israeli-based company working in conjunction with Dish 
Networks (EchoStar), Microsoft MSN, and Radio Shack in the U.S. It's the 



first large, organized c^Bpetition in the U.S. for. 



...testers) will be $69.95 a month, with a three-year contract. What's 
more, the stated performance goal is modest at 150-kbps downstream and 
100-kbps upstream. (No mention of latency times is... 

...exit fees for this deal -- since I don ! t really need this service. Gilat 
has acknowledged my request to beta test the service as a reviewer, but 
so far I ! ve heard nothing about whether... 

...to happen. AT&T Digital BroadbandBet you didn't know AT&T was getting 
into the fixed wireless Internet access and voice business, did you? 
Well, BB Report reader Maranda Maier did. She sent us... 

...packaging local, state, and long distance phone service, phone services 
including caller ID and three-way calling, wireless Internet service "up 
to 12 times as fast as" an analog modem, and home networking support for... 
Web page. Or call 1-877-288-34 85 for more information . The Inside Story on 
Sprint 1 s Wireless ServiceBB Report reader Norm Duncan wrote with 
information about the Sprint Broadband Direct service being tested in. . . 

...Sprint Broadband Direct starts at $39.95 per month for l-Mbps/256-kbps, 
two-way fixed wireless service, which uses Earthlink as the ISP. Norm 
writes: "I have some information about this service, which... 

...Technologies press release dated July 27, 2000: Sprint is heavily 
investing in Hybrid's two-way fixed wireless technology and equipment, 
and expects to deploy this service to 22 markets (presumably in the U.S... 

...to me: You might have the best firewall in the world, but if you're not 
actively monitoring for e-mail-borne worms, Trojan horses, and viruses, 
you're kidding yourself about being secure . If ... of fending attachment, and 
not offer the user the opportunity to "quarantine" or attempt to repair 
potentially dangerous code . In business computing circles, we have to 
adopt a code that says this: The sender of a virus is the one who is 
responsible for it, not... 

...was detected in their message, and that the recipient didn't receive the 
attachment . 4 . Most firewalls monitor for, or in some way protect against, 
inbound intrusions, but they don't all do an equal job in protecting for 
unwanted outbound transmissions of the type that Trojan horse 
malicious code might cause. Of course, the problem with protecting for 
unwanted outbound transmission is that it complicates the... 

...technician arrived as planned. He spent about an hour here. For most of 
that time he we watched rapid active pinging against my Flashcom gateway 

just as I have been doing with the LiveCon software. During 45 minutes 
of watching , we came across only one blip. A clear drop off that lasted 
only a few seconds. No... 

...55 AMCovad has also noticed packet loss issues on my line, and it just 
scheduled what Flashcom calls a "co-op" line test ...sites have you 
checked out that you liked? It could be broadband content, broadband tips 
or news, performance testing, utilities, you name it. Drop me a line. 
Please include the URL to the site, and. . . 

...Statement: Write me and tell me about something cool you downloaded. I 
know it's cool to watch how fast it comes down, and to compare just who 
has the fastest connection. But . . . frankly, that. . . 
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Fraud no longer a telecom secret. (Industry Trend or Event) 

Romberg, Denise 



Computing Canada, v24, n^Pf p25(l) 
Oct 13, 1998 

ISSN: 0319-0161 LANGUAGE: English RECORD TYPE: Fulltext 

WORD COUNT: 892 LINE COUNT: 00076 



... which used to be a secure technology, Karidis said. "But that's not 

the case anymore." 

Another cellular scheme he identified as "very clever technically 
and hard to track " was achieved through exploiting the connection 
logistics between a cellular phone and the public services telephone 
network (PSTN) . "There is a fraction of a second after the cellular call 
is terminated when the circuit actually remains open and the fraudsters 
would worm into that before the circuit was shut down." Fraudsters then 
would keep the circuit open and route calls onto that circuit using the 
same information and the same line until either the network shut it... 
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Wares extraordinaire 

Network World columnists and newsletter writers talk about 
category-breaking products and services . 

Byline: Staff 

Journal: Network World Page Number: 83 

Publication Date: November 13, 2000 
Word Count: 3083 Line Count: 288 



Text : 

. . . our 2000 Category-breaker Award. On the management front - Fred 
McClimansDon 1 t you just love when somebody asks you to name the best of 
something? It has a way of making me shiver for I... 

year - the Inf oCare service from SilverBack Technologies 
(coincidentally, one of Network World's 10 start-ups to watch in 
2000) .What do I like about InfoCare? Well, what 1 s not to like? SilverBack 
has combined. . . 

... the health of your network infrastructure at any time. The InfoCare 
service consists of a few powerful monitoring and reporting tools 
installed within a user's site. These tools, sold on a yearly subscription 
basis, can track and easily display network and server performance 
status, network or IT failures or hot spots, security threats or the 
condition of any IP device... 

. . . to which a customer site is linked via a secure connection. From this 
support center, SilverBack can perform outsourced management functions , 
such as service-level agreement (SLA) monitoring , internal IT 
trouble-ticket response (such as first-level tech support), software 
monitoring and upgrades, and data backup. In short, anything that you 
would normally do internally, SilverBack can arrange... 

... doesn't need to make all the management tools, just help you use them 
better. You can monitor the process through a series of Web-based 
monitoring tools. These are significantly different from the bulky, 
overbuilt, Sovietesque management tools favored for onsite deployment by. . . 

. . . enables the cards to run out of the box with almost any new 
voice-capable client, including notebooks , telephones and cell phones 
When the user presses the Comdot button, the card emits an encrypted, 
high-frequency, sound-based digital identifier that, at short range, 
authenticates the user to the PC (or voice-capable client) and network 
applications. . . 

. . . the card - and something you know, such as a password. Smart cards let 
users keep their personal identification numbers (PIN), passwords and 



l^^l - in the card's protected mem^ 



secret keys in a safe pl^PI - in the card's protected meirraBy - rather... can 
contribute the other authentication factors needed to enable a truly secure 
card-access environment, acquire such functionality or develop it 
in-house. ComSense faces an uphill battle against a general feeling that 
smart cards . . . 



...exposure to network security breaches, considering the range of banking, 
brokerage and other accounts accessible online. This wireless smart card 
could become a fast, cheap, easy way for average users to hang virtual 
padlocks on... only available with a robust directory service. RadiantOne is 
also flexible in data presentation. Depending on the query it receives, 
RadiantOne can render the data as XML- , LDAP- or SQL-formatted information 
when returned to. . . 

... Out on the 'Net - Audrey RasmussenWith its eAssurance software, 
Peakstone creates a new product category, which it calls "Internet 
service assurance." The eAssurance software provides a comprehensive 
business approach to sitewide Internet service-quality management. Many 
load-balancing products even out the load of Web site requests across 
servers in the hope of providing better service to customers . But 
eAssurance lets e-businesses and. . . 



...SLM) products, eAssurance doesn't rely on a component- or device-centric 
approach. Rather, it analyzes user request patterns of incoming Internet 
traffic and utilization of system resources. It then controls the loads for 
site . . . 



. . .WebSystems, BEA Systems, Cisco, F5 Networks, Mercury Interactive and Top 
Layer Networks. Plus, it measures the site performance for applications 
and user groups, in real time and historically. It predicts site saturation 
points and pinpoints... 

. . . danger of scanning. Hackers scan for new IP addresses on a daily and 
nightly basis. Once they identify new ones, they scan for port 
weaknesses. Most users aren't fluent in unbinding protocols such as... 

... at the desktop and what it's attempting to do. This approach adds to 
overall virus and malicious code protection. The second is an attack 
from a "trusted insider." Personal firewalls can detect internal network 
scans... desktop firewalls made by Network Associates, Network Ice (one of 
Network World's 10 start-ups to watch in 2000), Sygate Technologies, 
Symantec and Zone Labs. Schwartau is the president of Interpact, a security 
awareness . . . 
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Antivirus vendors gear up for phones, PDAs 

Byline: James Niccolai 

Journal: Network World 

Publication Date: September 26, 2000 

Word Count: 8 68 Line Count: 7 8 

Text : 

. . . first virus aimed at Palm computers, antivirus software vendors are 
scrambling to develop products that protect against malicious code 

aimed at PDAs, mobile phones and other wireless devices. </p> To be 
sure, the problem today is a small one, and industry analysts say it could 
be 12 months or more before PDAs and cellphones are hit with the kind of 
crippling viruses that have brought PC networks to their knees. Their... 

. . . spread automatically from one device to the next, and most PDAs still 
don't make use of wireless connections, analysts said. </p> But with Palm 
and Microsoft hell-bent on expanding the wireless features in their 
platforms, and an expected explosion in data-enabled cellphone use on the 



horizon, the possible ^^lergence of a virus that is abl^Pto spread itself 
rapidly. . . 

... to' various industry analysts. </p> Antivirus vendors are pursuing 
several angles to protect phones and PDAs against malicious code . Their 
limited processing power and memory capacity compared to desktop PCs makes 
the challenge a tough one... 

... come up with some creative solutions. </p> Late last month, Network 
Associates' McAfee division released McAfee VirusScan Wireless , a product 
designed primarily to guard corporate networks from viruses carried into 
work on a PDA by. . . 

... line of defense for IS managers but doesn't protect users from 
downloading viruses directly to their handheld devices, either via the 
Web and e-mail, or through the infrared beaming feature on some PDAs... 

. . . EPOC, the application is available now and measures about 60K bytes in 
size, a company official said. Wireless data services for phones are more 
advanced in Northern Europe than in the U.S., so it . . . 

... a malicious program attempts to delete a file or open a network 
connection, for example, the software blocks the behavior and alerts the 
user. </p> Finjan is developing an antivirus product for Palm and 
Microsoft. Packet " PC devices that uses this method, although it doesn't 
expect to release it before year-end. Next month, however, it plans to 
release a kind of interim product that, like McAfee's, looks out for 
viruses while data is synchronized between a Palm computer... 

... scanning for known viruses. </p> Trend Micro also advocates a 
server-based approach and is developing a Wireless Application Protocol 
gateway software that will scan files for malicious code before they 
are distributed to users. As unified messaging grows up, allowing users to 
access email, voice... 

. . . virus writers will be equipped with more tools to do their work. </p> 
"It's possible to prevent these vulnerabilities, but if doing so 
interferes with what developers feel they need in terms of features . . . 
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Palm Trojan spurs antivirus vendors to action 

Byline: JAMES NICCOLAI 

Journal: Network World Page Number: 68 

Publication Date: September 25, 2000 
Word Count: 84 3 Line Count: 7 8 

Text : 

With the emergence last month of the first Trojan horse aimed at Palm 
computers, antivirus software vendors are scrambling to develop products 
that protect against malicious code aimed at PDAs, mobile phones and 
other wireless devices. To be sure, the problem today is a small one, and 
industry analysts say it could be 12 months or more before PDAs and cell 

phones are hit with the kind of crippling viruses that brought PC 
networks to their knees. Their bare... 

... that spread from one device to the next, and most PDAs still don't make 
use of wireless connections, analysts say. But with Palm and Microsoft 
hellbent on expanding the wireless features in their platforms, and an 
expected explosion in data-enabled cell phone use on the horizon, the 
possibility of a virus emerging that can spread rapidly between devices 
will. . . 

... year, according to industry analysts . Antivirus vendors are pursuing 
several angles to protect phones and PDAs against malicious code . Their 



limited processing power^Pftd memory capacity compared wit^^Eiesktop PCs make 
the challenge a tough one... 



... to come up with some creative solutions . Late last month, Network 
Associates' McAfee division released McAfee VirusScan Wireless , a product 
designed primarily to guard corporate networks from viruses carried into 
work on PDAs by employees... 

... of defense for IS managers, but it doesn't protect users from 
downloading viruses directly to their handheld devices, either via the 
Web, e-mail or the infrared beaming feature on some PDAs . Symantec says... 

. . . Antivirus for Epoc, the application is available now and measures about 
60K bytes, a company official says. Wireless data services for phones are 
more advanced in Northern Europe than in the U.S., so it... 

. . . example, if a malicious program attempts to delete a file or open a 
network connection, the software blocks the action and alerts the user. 
Finjan is developing the antivirus product for Palm and Microsoft Pocket 
PC devices, although it doesn't expect to release it before year-end. 
Next month, however, Finjan plans to release an interim product that, 
like McAfee's, looks out for viruses while data is synchronized between a 
Palm computer. . . 

... monitoring and scanning for known viruses . Trend Micro also advocates a 
server-based approach, and is developing Wireless Application Protocol 
gateway software that will scan files for malicious code before they 
are distributed to users. As unified messaging grows up, allowing users to 
access e-mail. . . 

. . . example, virus writers will be equipped with more tools to do their 
work. "It's possible to prevent these vulnerabilities, but if doing so 
interferes with what developers feel they need in terms of features... 
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Surfing the Tsunami 

A large Southeastern university IS team fights off a massive distributed 
denial of- service attack and lives to tell about it. 

Byline: By DDos Survivor 

Journal: Network World Page Number: 51 

Publication Date: August 28, 2000 
Word Count: 2101 Line Count: 182 

Text : 

...bogus packets threatened to overwhelm our network backbone. To save the 
network, we had to spring into action . The following account describes 
how we discovered the attack, identified the machines being used to 
perpetrate the attack, and what measures we put in place to prevent 
another attack. Approaching distributed denial-of -service dayln the weeks 
before the attack, some strange outages had. . . 

. . . the network card; a dime store NIC can really bog down the system. 
Remember that the primary function of this system is to grab data off the 
network and process it quickly. We chose Red. . . 

... Linux applications:! Snort, a packet/sniffer logger and lightweight 
intrusion-detection system. 1 Iptraf, a network monitoring utility for IP 
networks. 1 Tcpdump, a packet capture and dump program. A probe is useless 
unless it is located where it can see all traffic on the network segment 
being monitored . Our network is completely switched - each port receives 
only those packets destined for the machine connected to it. So how did we 
put the probe in the middle of all the activity ?We took advantage of the 
port-mirroring feature on our Cisco Catalyst 6509 switches. Port mirroring 
lets . . . 



. . . absolutely necessary. We use a passive tap - an optical probe or an 
Ethernet repeater - for long-term monitoring . We connected the probe to 
an unused port, set the port to mirror the traffic on the segment we 
wanted to watch , and we were in business. 1 p.m. As soon as we activated 
the probe, we fired. . . 

. . . was in use, had egual byte and packet counts, and the counts were 
rapidly increasing as we watched . It didn 1 1 take a NASA meteorologist to 
figure out that the tidal wave was about to... 

... was happening. 4:45 p.m. To dig deeper, we called on Snort, a free, open 
source code application written by Martin Roesch, director of Forensic 
Systems at Hiverworld in Berkeley, Calif. Snort is a... 

... don 't let the term "lightweight * throw you. This is serious software 
and is our intrusion-detection code of choice. Snort uses a flexible 
rules language that lets users describe what types of traffic should. . . 

. . . immediately detected that we were being attacked. Unfortunately, this 
wasn 't the case. The initial burst of activity that led to the isolation 
of the problem only lasted 20 minutes. By the time we had... 

... about which hosts had been compromised . Snort came to our rescue. Using 
the software to replay network activity from a captured file, we 
determined that the rogue machines on our network were set in motion... 

... local Unix machines involved in the attack. 4:45 p.m. The first step we 
took to block the bad boys was to put ingress/egress filters on our 
Internet router. Script kiddies that run... 

. . . hold much hope for keeping them out for long, but we got lucky. As soon 
as the blocks went in, the attacks ended. We were still left with the 
daunting task of determining if there... 

. . . more, as yet unknown, machines primed and ready to be used in another 
attack. We contacted the interim systems administrator of the machines 
that had been hacked (the department was between system administrators and 
had. . . 

... permission to scan the network for infected machines. While our 
university security person was working with the interim systems 
administrator to scan the network segment for further infection, several of 
our network engineers were feverishly... 

. . . and Internet2 feed. We knew the hackers would initiate another wave of 
bogus distributed denial-of-service requests , and this time we 1 d be 
ready. Noise, noise, noiseOur primary off-campus link is a Gigabit... 

. . . the possibility of overloading the router by forcing it to duplicate 
packets during periods of intense network activity . 8:20 p.m. Our first 
discovery after activating the new probe was that the supplied rules... 
typically operate 30 levels deep, and because we sustained no lasting 
damage to our network we felt tracking them down was not worth the time 
and effort. Life is returning to normal. We feel safer with a 
round-the-clock intrusion-detection system watching our Internet feed, 
but we know that it f s only a matter of time before another set... 
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Frontier Defense 

Keep the Bad guys away from your remote outposts 

Byline: STEVE JANSS 

Journal: Network World Page Number: 42 

Publication Date: August 07, 2000 



Word Count: 3374 Vhe Count: 318 



Text : 

... a personal firewall include: Your mobile worker who plugs into a 
variety of networks while traveling. Their laptop may be protected 
against viruses, but the data is wide open. Your small, remote or branch 
office... product for you. Unfortunately, while BlacklCE Defender blocks 
ports , it doesn ' t control applications . Thus , if a Trojan horse finds 
its way onto your system, the horse can use any open port to communicate 
with its . . . 



... Windows NT.ZoneAlarm installs two services during installation - the 
TrueVector Basic Logging Client and the TrueVector Internet Monitor . Zone 
Lab's patented TrueVector technology monitors and controls all network 
activity - whether someone is logged on to the machine or not. All alerts 



... activity are simple and give you two choices: allow the connection or 
refuse the connection. ZoneAlarm also asks you whether or not you want it 
to remember your choice. Alarms for known activity are merely... 

. . . which hides all ports not in use by an authorized program by not 
responding to port status requests such as those encountered during port 
scans. The medium setting is best reserved for local use, which... be 
disabled via the security panel. ZoneAlarm 1 s setup was simple, installing 
the logging client and Internet monitor without a reboot. Unlike most of 
the other products, ZoneAlarm uses an HTML-based help system stored. . . 

. . . NetBIOS Datagram. Why is it important to block the MAC address? First, 
it's a globally unique identifier . When combined with other information, 
this lets hackers pin down a particular machine, even when IP addresses... 
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Your e-volution \ 

The Internet ecoiromy has conjured 
you know how to grasp them? 

Byline: BETH SCHULTZ 
Journal: Network World Page 
Publication Date: July 17, 2000 
Word Count: 1891 Line Count: 



up a world of career opportunities . Do 

Number: 55 
170 



Text : 

...for a multimillion-dollar budget, as vice president of IS at Point.com, 
an online retailer of wireless phones, service plans and accessories . "So 
what," you say. "Point.com is just a little Internet start... 



. . . the Internet economy is affecting your company, and therefore, your 
career. The question you've got to ask yourself now is: "Will I be helped 
or hurt?" To answer, you need to understand what IT... the CEO slot - meaty 
stock options, a plentiful IT budget. But such job offers are often a 
Trojan horse . You'll be working long, hard hours for an immature 

company using an unproven business model chasing. . . 

... unquestionable futures. Such a company would understand how to play in 
the New Economy, or at least recognize its importance and need you to get 
it there. A top executive slot is not the only... 
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In the way of open 
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Tracking software usage 

KeyServer is tops among six software metering programs that tackle similar 
tasks in different ways . 

Byline: JAMES GASKIN, NETWORK WORLD TEST ALLIANCE 
Journal: Network World Page Number: 4 3 

Publication Date: August 09, 1999 
Word Count: 2888 Line Count: 274 

Text : 

. . . has matured to the point that metering accuracy is almost guaranteed. 
All the programs we looked at track every application users run on their 
computers, ensure there is a valid license for each program and... 

... management. Some programs focus on the users, others on the 
applications . All six programs we tested can block server and local 
application usage. All have time-sensitive controls, so you can make games 
off-limits . . . 

... NDS). Queues for applications are popular features, as are tricks to 
verify that licenses are held by functioning , . nonlocked computers. Every 
metering program has some method of allowing VIP users to access 
applications even when. . . 

... Express Software Manager 4.5 impressed us with its extensive report 
options and a huge library of recognized applications, but its client and 
server support isn't as strong as KeyServer' s. A NetWare bias... 

. . .CentaMeter 2.90a is more application-centered than the other products we 
tested; it ties nearly every function to applications rather than users. 
Easy installation, flexible management and a wide reach across the 
enterprise are... 

... but AppMeter's reports are stronger. One of AppMeter's best features is 
that you can easily monitor and administer multiple servers across the 
network from a single console. Even more NT-centric than WRQ. . . 

. . . User names can be typed in during installation, pulled from the Windows 
name in the system or identified through a system environment variable on 
each machine. As soon as the client software is installed and... 

. . . select one of three levels of control for each program: ignore, log or 
control. The programs we instructed KeyServer to ignore, such as system 
files, were properly ignored from that point on. Logged programs are simply 

tracked and reported. Controlled programs have a bite taken from them and 
stored on KeyServer. Until KeyServer provides the key piece of code , the 
application won't start. Because applications are modified, you can copy 
and distribute them in their. . . the information to the Express Console 
quickly and without user intervention. Express includes a huge library of 

recognized applications in its Knowledge Base. Applying the Knowledge 
Base to the autodiscovered list of applications identifies just about 
every single program on each client. You can then detail unrecognized 
applications and add them. . . 

. . . their internal applications flexibly, allocating licenses to entire 
suites or individual applications. A special VIP password can temporarily 

disable metering on files to allow critical users access to applications. 

Laptops can check out a license, or you can give each laptop its own 
applications with proper licenses .WRQ T s report selection is unmatched. When 
we started WRQ's Express Reports application, we found roughly 70 reports 
grouped by application, machines, users, suites and activity . Custom 
options depend on whether you're using an Access 97 database or Microsoft's 



SQL Server . . . 




. . . excellent job of hyperlinking every topic. All the positives - easy 
installation on NT, a huge library of recognized applications and 
excellent reports - are somewhat dimmed by the lack of directory 
integration. Though Active Directory is... 

...for NetWare 3.X and ties neatly into NDS in NetWare 4.X and 5.X. Active 
monitoring files run as NetWare Loadable Modules on NetWare servers, and 
the package includes a snap-in for... 

. . . that starts the NetWare server portions of SofTrack to the NetWare 
start-up batch file. Clients are tracked through their NDS activity , so 
use of server-based applications is monitored immediately. Local 
applications require a local program to run and report back to the server. 
A check. . . 

. . . control files are bypassed, allowing nonmetered access to local 
applications . The manual says the program can't track DOS applications 
within a Windows DOS box, but SofTrack immediately caught our 3C5x9CFG.EXE 
network board configuration DOS program within a Windows 95 client. You can 
select applications to monitor from a list of programs discovered by the 
SofTrack servers, or you can type application executable files by hand. 
If your client applications are stored on local and network drives, you 
must add a client program to track local files and monitor them 
separately. Reports cover a variety of management details and are based on 
log files stored by... the network. For stations that can get to net servers 
without using a logon script, CentaMeter includes instructions for using 
system policies on Windows 95, 98 and NT machines . CentaMeter supports three 
types of metering: passive metering counts the applications used; 
restricted metering blocks access without a license; and LSAPI-enabled 
metering monitors application use and sends information to the license 
server. CentaMeter includes scores of predefined applications likely to... 

. . . that starts automatically when you click the "Extended Report" option. 
For custom reports, you can build special queries and save them for 
reuse. No paper manual arrived, but the PDF manual is a joy. Hyperlinks... 

. . . NetWare and NT servers, easily integrates NDS users and has a "stealth" 
metering mode that lets you track server-based applications without any 
software on the client. Our biggest gripes? The poor directions in the... 

...Servers are managed individually from a single console, and most reports 
are server-centric. User details are tracked across servers, and the 
included Crystal Reports provides other server consolidation options. We had 
trouble finding client... 

. . . license details, including host server, license name and a description 
typed during license setup; and real-time monitoring details, including 
the numbers of licenses, active users and users waiting. AppMeter lets you 
deem licenses permanent... 

... with a special client application. These local applications aren't 
portable. The client must obtain the key code from the server for the 
application to run. AppMeter generates reports by filtering log files and 
offers . . . 

... the program offers some nice touches. A Quick Start page on the console 
puts all the major functions one click away, including adding new 
products, configuring products, viewing licensed and unlicensed products, 
and linking to. . . 

... suites and their internal applications. Three pull-down menus, labeled 
Configuration, Operations and Status, put even more functions a click 
away. Not only does Lan Licenser plug into SMS, but Microsoft licensed it 
to fold. . . 
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